Bookmarks tagged hacking

"If you don't live under a rock, you might've heard of Bluesky, a decentralised social microblogging app built on top of the AT Protocol. In early June 2023, I identified a vulnerability in Bluesky's core user identity mechanism, did:plc, which allowed me to modify the identity information associated with any* account. I tested my hypothesis by changing the handle of the official @bsky.app account."

Using built in microphones (which capture electromagnetic leakage) to cheat at games over discord (and other voice platforms)

"We show that built-in sensors in commodity PCs, such as
microphones, inadvertently capture electromagnetic side-
channel leakage from ongoing computation. Moreover, this
information is often conveyed by supposedly-benign chan-
nels such as audio recordings and common Voice-over-IP
applications, even after lossy compression.
Thus, we show, it is possible to conduct physical side-
channel attacks on computation by remote and purely passive
analysis of commonly-shared channels. These attacks require
neither physical proximity (which could be mitigated by dis-
tance and shielding), nor the ability to run code on the target
or configure its hardware. Consequently, we argue, physical
side channels on PCs can no longer be excluded from remote-
attack threat models.
We analyze the computation-dependent leakage captured
by internal microphones, and empirically demonstrate its effi-
cacy for attacks. In one scenario, an attacker steals the secret
ECDSA signing keys of the counterparty in a voice call. In
another, the attacker detects what web page their counterparty
is loading. In the third scenario, a player in the Counter-Strike
online multiplayer game can detect a hidden opponent waiting
in ambush, by analyzing how the 3D rendering done by the
opponent’s computer induces faint but detectable signals into
the opponent’s audio feed."